VRChat says attackers accessed its cloud environment and stole account data belonging to 2,436,782 users. The company told Maine regulators the intrusion lasted from May 10 to May 12, 2026, and exposed VRChat usernames, email addresses, VRChat+ subscription status, login history including device and hardware identifiers and IP addresses, plus linked Steam or Meta user IDs. VRChat said passwords, payment card data, and government IDs used for age verification were not affected.
Why it matters: Affected users face increased risk of phishing, account-targeted scams, and privacy exposure because the stolen data links identities, devices, and login activity. Users should watch for impersonation emails and messages tied to VRChat, Steam, or Meta accounts, and defenders should review any reuse of exposed metadata in follow-on attacks.
2026.06.11
100% relevant
This article appears to be the first concrete reporting in the set on VRChat's own disclosure to Maine regulators that a cloud intrusion exposed data from roughly 2.44 million user accounts.
← Back to all stories